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@ Apparatus and method for controlling access to data using domains. 



(57) In an object-based computer system, each 
object is contained in, and each task executes 
in, a protection domain. Domains exist at sev- 
eral hierarchical domain levels, (301-305) some 
levels having multiple discrete domains (320- 
322 ; 340-342), while others have one common 
domain. A task may access an object if the 
domain in which the task is executing is the 
same as the domain containing the object, or if 
the domain in which it is executing occupies a 
higher hierarchical domain level than the do- 
main containing the object Each object in- 
cludes a domain attribute, which is a numerical 
value defining the domain in which it is con- 
tained. The domain attribute of the currently 
executing task is stored in a domain register. 
When an attempt is made to access data within 
an object, the domain attribute of the object is 
compared with the domain attribute stored in 
the domain register. If the access conditions are 
met, access is permitted. 
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